Privacy Policy

This website is operated by Kunor Xue, who acts as the data controller under the EU General Data Protection Regulation (GDPR) and China's Personal Information Protection Law (PIPL).

Data you provide voluntarily:

• Name, email address, and message content submitted via the contact form
• Email address when subscribing to the newsletter

Data collected automatically (with your consent only):

• Pages visited, session duration
• Device type, browser, operating system
• Anonymous visitor ID (stored in localStorage, no PII)
• Referring page (referrer)

Infrastructure data (no consent required; legitimate interest basis):

• Cloudflare access logs (including IP addresses) for security and CDN
• Vercel server logs retained briefly for error debugging

Under GDPR Article 6, we process personal data on the following legal bases:

• Consent (Art. 6(1)(a)): analytics cookies and visitor tracking
• Contract performance (Art. 6(1)(b)): responding to contact form submissions
• Legitimate interests (Art. 6(1)(f)): website security, DDoS protection

• To respond to your inquiries and requests
• To send newsletter content (with consent)
• To analyze site usage and improve content quality
• To detect and prevent malicious traffic and security threats

We do not sell personal data, build advertising profiles, or make automated decisions affecting individuals.

We share data with the following service providers under binding data processing agreements:

• Cloudflare, Inc. (USA) — CDN and security; EU Standard Contractual Clauses (SCC)
• Vercel, Inc. (USA) — web hosting; SCC + adequacy decision
• Self-hosted API server (Tencent Cloud, Hong Kong SAR) — anonymous analytics storage

Transfers to countries outside the EU/EEA are safeguarded by:

• EU Standard Contractual Clauses (SCCs, 2021 edition)
• European Commission adequacy decisions where applicable

• Contact form data: deleted within 12 months of reply
• Analytics data: retained for 24 months in aggregated anonymous form
• Visitor ID (localStorage): cleared when browser storage is cleared or consent is withdrawn
• Cloudflare logs: up to 30 days per Cloudflare policy

Under GDPR you have the right to:

• Access (Art. 15): obtain a copy of your personal data
• Rectification (Art. 16): correct inaccurate data
• Erasure (Art. 17): request deletion ("right to be forgotten")
• Data portability (Art. 20): receive data in a structured format
• Objection (Art. 21): object to processing based on legitimate interests
• Withdraw consent: at any time, without affecting prior processing
• Lodge a complaint: with a supervisory authority (e.g., the German Federal DPA)

To exercise these rights, email kunorxue@gmail.com. We respond within 30 days.

Under PIPL, you have the right to know, decide, access, copy, correct, supplement, and delete your personal information (Arts. 44–47), and to withdraw consent (Art. 15).

We commit to: not collecting data beyond what is necessary; not selling personal information to third parties; obtaining explicit consent before cross-border transfers.

You may also lodge a complaint with the German Federal Commissioner for Data Protection (BfDI) or your local supervisory authority.